The National Institutes of Health has implemented 14 of the 15 federal research security requirements the Government Accountability Office reviewed, covering disclosure, malign foreign talent recruitment programmes, training and information sharing, but it manages the risk mainly by trusting what researchers disclose. GAO found NIH relies heavily on self reported information to identify foreign interference risks and generally does not verify disclosures using outside sources unless it receives an allegation.
The record shows what that system catches after the fact. From 2017 through 2025 NIH received 697 allegations of potential foreign interference involving personnel on its awards. It found disclosure violations in 264 cases, and NIH or recipient institutions took action in most of them, including barring individuals from awards. In seven case studies, GAO itself used outside sources to find publicly available information about foreign affiliations and coauthored publications that did not appear in the award documentation. GAO notes the cases are not generalisable and do not establish prevalence, but they show the gap is real rather than theoretical.
Two structural holes sit underneath. NIH does not require disclosure of all past affiliations, and foreign component disclosures are required only when a significant element of the funded project is performed outside the United States, so relevant information may never be required to be disclosed at all. GAO also found NIH’s risk management is not fully aligned with its Fraud Risk Framework: the annual risk inventory considers fraud but is not a documented, programme specific assessment of fraud schemes, controls and residual risks.
The finding pairs with yesterday’s GAO report on the FBI, which found the bureau has no plan for the university partnerships it depends on to spot non traditional intelligence collectors. One agency lacks the relationships, the other lacks verification of the paperwork. Between them they are the federal research security system for the roughly 35 billion dollars NIH awarded extramurally in fiscal 2025.